Trust & compliance
Fast is only usefulinside the rules.
At a glance
Six things a review asks for.
Consent ledger
Every grant and withdrawal recorded with where it came from. Append-only; erasure keeps the proof that it happened.
Per-country contact rules
NewCalling hours, uploaded do-not-call registers and AI disclosure, checked before every touch.
Privacy & breach register
Retention periods per kind of data, export and erasure on request, and a breach register with the deadlines worked out.
Roles, SSO, SCIM, audit
Per-person capabilities and record scopes, SAML single sign-on, SCIM provisioning and an exportable audit trail.
Invoices
A document for every top-up and a monthly usage statement built from the same ledger that charged you.
White-label
Run it on your own domain and brand, with each client isolated in their own account.
Contact rules, by country
Checked before every call and message.
United States TCPA · National Do Not Call Registry · state calling laws
What the rules say
- Telemarketing calls that use an artificial or prerecorded voice need the person’s prior express written consent, and the FCC confirmed in 2024 that AI-generated voices count.
- Telemarketing calls are limited to 8am to 9pm in the called person’s local time, and numbers on the National Do Not Call Registry are off-limits without consent.
- Several states add stricter hours, call caps or registration on top.
What AvA checks
- Every consent and withdrawal recorded with its source, in an append-only ledger
- One opt-out stops every journey, on every channel
- Calling hours resolved in each contact’s own time zoneNew
- Upload the do-not-call lists you scrub against; listed numbers are never dialledNew
- The AI says it is an AI at the start of the callNew
United Kingdom PECR · TPS / CTPS · UK GDPR
What the rules say
- Live marketing calls must not go to numbers registered with the Telephone Preference Service (or the Corporate TPS) unless that person has told you they want them.
- Automated marketing calls need the person’s specific prior consent.
- Personal data is handled under UK GDPR, with the ICO as regulator.
What AvA checks
- Every consent and withdrawal recorded with its source, in an append-only ledger
- One opt-out stops every journey, on every channel
- Upload TPS and CTPS lists; listed numbers are screened out before a callNew
- UK calling hours you set, enforced per contactNew
- AI disclosure at the start of every callNew
Canada CASL · National DNCL
What the rules say
- Commercial emails and texts need consent, identification of the sender and a working unsubscribe (CASL).
- Telemarketing calls follow the CRTC’s rules and the National Do Not Call List.
What AvA checks
- Every consent and withdrawal recorded with its source, in an append-only ledger
- One opt-out stops every journey, on every channel
- Consent checked per channel before an email or SMS is sentComing soon
- Unsubscribe honoured across every journey
- Upload the National DNCL; listed numbers are never dialledNew
European Union EU AI Act (Article 50) · GDPR · national calling rules
What the rules say
- From 2 August 2026, people must be told when they are interacting with an AI system unless it is obvious.
- Personal data is processed under the GDPR; each member state sets its own rules for marketing calls.
What AvA checks
- Every consent and withdrawal recorded with its source, in an append-only ledger
- One opt-out stops every journey, on every channel
- AI disclosure spoken at the start of every callNew
- Data export and erasure on request, with a receipt
India TRAI TCCCPR · DND / NCPR · DPDP Act
What the rules say
- Business calls must come from numbers declared to the carrier, with promotional calls on the 140 series, and people on the DND register must not get promotional calls.
- The Digital Personal Data Protection Act requires notice and consent, honours erasure requests, and requires breaches to be reported to the Data Protection Board.
What AvA checks
- Every consent and withdrawal recorded with its source, in an append-only ledger
- One opt-out stops every journey, on every channel
- Each campaign declares its purpose; calls are checked against the number they leave from
- DND-registered numbers left out of promotional campaigns
- Data rights (download, erase), retention periods and a breach register
United Arab Emirates UAE telemarketing rules · Do Not Call Registry (DNCR) · PDPL
What the rules say
- Telemarketing is regulated, including the hours calls may be made and the national Do Not Call Registry.
- Personal data is handled under the UAE’s federal data protection law.
What AvA checks
- Every consent and withdrawal recorded with its source, in an append-only ledger
- One opt-out stops every journey, on every channel
- Upload the DNCR list; listed numbers are never dialledNew
- Calling hours you set, enforced per contactNew
- AI disclosure at the start of the call, in Arabic or EnglishComing soon
These are short summaries to show what AvA checks, not legal advice. The rules change and have exceptions; confirm what applies to your business with your own adviser. You decide who to contact and on what basis; AvA enforces the rules it can see and keeps the record.
Privacy
The record, and the right to be forgotten.
- A consent ledger that is append-only: every grant and withdrawal with its source and time
- Erasure that keeps a receipt, so you can prove a deletion happened without keeping the data
- Download everything held about a person, on request
- Retention periods you set per kind of data, with a log of what was purged and when
- A breach register that works out each notice deadline and drafts the notices
- A grievance officer and privacy notice shown on your forms and in data exports
Access & security
Who can do what, and proof of who did.
- Roles for your team, plus per-section permissions: none, view, edit or manage
- Scopes per person: limit a teammate to certain assistants, campaigns or WhatsApp numbers
- SAML single sign-on, with domains proved by DNS before they can be used
- SCIM provisioning from your identity provider
- An audit trail of sensitive actions, kept 90 days and exportable as CSV
- Every signed-in device listed, with sign-out per device and an email on a new device or country
- API keys scoped per section, revocable, and never shown in full to people who cannot manage them
Data handling
- Traffic encrypted in transit
- Connected-app secrets and tax details encrypted before they are stored, and never sent back to the browser
- Call recordings in private storage, served only through short-lived signed links, and switchable off per number
- Each client account isolated on the server, not just hidden in the interface
Questions
Asked in every review.
Is AvA SOC 2 or ISO 27001 certified?
Not yet. This page describes the controls that run today instead, and we will answer a security questionnaire on request.
Where is data stored?
Our main application servers and file storage run on Amazon Web Services in India. The sub-processor list names every vendor and, where we can state it, the location; the rest are given in the DPA.
Does AvA make my calls legal?
No tool can. You decide who to contact and on what basis. AvA checks the consent you recorded, your contact hours, the do-not-call lists you upload and the opt-outs it has received before every call or message, says it is an AI, and keeps the record you would need to show what happened.
Can I get a data processing agreement?
Yes. A DPA is available on request, with the full sub-processor list.
Hear your own AI call you, in ten minutes.
Tell it your website, where your leads come from and your phone number. It builds the desk and rings you first.